August Vulnerability of the Month: Critical Vulnerability in Oracle WebLogic Targeted by Attackers

In August, Tenable Research voted to highlight CVE-2018-2893 in Oracle WebLogic Server because it was almost immediately exploited by multiple threat actors.

Novelty, sophistication or just plain weirdness are some of the potential criteria we use to select the Tenable vulnerability of the month. We collect nominations from our 70+ research team members, shortlist the finalists and give the entire team the chance to vote – combining the total experience and knowledge of Tenable Research to identify the vulnerability of the month.

Background

CVE-2018-2893 caught our researchers’ attention this month. It allows for remote, unauthenticated attacks and received a CVSSv3 score of 9.8. While the vulnerability was patched in the Oracle Critical Patch Update on July 17, researchers saw exploitation in the wild of this vulnerability as early as July 21. Two separate groups were seen exploiting this vulnerability in large-scale attacks in the days following disclosure, likely fueled by publication of multiple proofs of compromise.

What makes this the vulnerability of the month?

The quick turnaround between disclosure of the vulnerability and exploitation in the wild is worth noting. While it may take months for some vulnerabilities to have a public exploit, some are valuable enough to warrant almost immediate exploitation. Our recent report, Quantifying the Attacker’s First-Mover Advantage, found that 34% of the most prevalent vulnerabilities had an exploit available on the same day they were disclosed publicly.

Vulnerabilities in WebLogic servers have become quite common (there have been nine disclosed so far in 2018, with CVSSv2 scores ranging from 5.8–7.5), and threat actors have been increasingly targeting them in the last year, particularly for mining cryptocurrency. While Oracle has been releasing patches to address these vulnerabilities as they are discovered and disclosed, more than once researchers have found ways to bypass the fixes, further complicating the issue. CVE-2018-2893 continues a vulnerability trend that shows no sign of changing.

The value of cryptomining is a strong motivator for criminals to target these vulnerabilities. In addition to cryptomining, Oracle WebLogic servers are frequently connected to systems containing sensitive data, such as intellectual property or personally identifiable information (PII), which could be tempting targets for attackers.

Vulnerability details

A recently patched flaw discovered in the WebLogic Server Core Components subcomponent of Oracle Weblogic allows a remote, unauthenticated attacker to take complete control over a host. The vulnerability is caused by unsafe deserialization of Java objects, an attack vector that’s been in the news several times in recent years. Using a crafted request over the T3 protocol, an attacker can execute arbitrary code on an affected WebLogic server, leading up to full control over that host. Reports have surfaced on social media suggesting there are ways to bypass the patch and continue to exploit a vulnerable host. However, this is yet to be confirmed by Oracle.

Global

Try Tenable.io

FREE FOR 60 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

Thank You

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Try Tenable.io Web Application Scanning

FREE FOR 60 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now and run your first scan within 60 seconds.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

Thank You

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Thank You

Thank you for your interest in the Tenable.io Container Security program. A representative will be in touch soon.

Learn More about Industrial Security

Try Tenable.io free for 60 days. Protect your organization from WannaCry, NotPetya and other ransomware cyberattacks. Get Started

The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.